5.11.21-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainerPATCH 587/601 ia64: fix EFI_DEBUG build
In reply to Greg Kroah-HartmanFrom: Sergei Trofimovich <[email protected]>
[ Upstream commit e3db00b79d74caaf84cd9e1d4927979abfd0d7c9 ]
When enabled local debugging via #define EFI_DEBUG 1 noticed build failure:
arch/ia64/kernel/efi.c:564:8: error: 'i' undeclared (first use in this function)
While at it fixed benign string format mismatches visible only when EFI_DEBUG is enabled:
arch/ia64/kernel/efi.c:589:11:
warning: format '%lx' expects argument of type 'long unsigned int', but argument 5 has type 'u64' {aka 'long long unsigned int'} [-Wformat=]
--- arch/ia64/kernel/efi.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
arch/ia64/kernel/efi.c +6 -5
@@ -413,10 +413,10 @@ efi_get_pal_addr (void) mask = ~((1 <<IA64_GRANULE_SHIFT ) -1 );printk (KERN_INFO "CPU %d: mapping PAL code " -"[0x%lx-0x%lx) into [0x%lx-0x%lx)\n" , -smp_processor_id (), md->phys_addr, - md->phys_addr +efi_md_size (md), - vaddr & mask, (vaddr & mask) +IA64_GRANULE_SIZE ); +"[0x%llx-0x%llx) into [0x%llx-0x%llx)\n" , +smp_processor_id (), md->phys_addr, + md->phys_addr +efi_md_size (md), + vaddr & mask, (vaddr & mask) +IA64_GRANULE_SIZE );#endif return __va (md->phys_addr); }
@@ -558,6 +558,7 @@ efi_init (void) {efi_memory_desc_t *md;void *p; +unsigned int i;for (i =0 , p = efi_map_start; p < efi_map_end; ++i, p += efi_desc_size)
@@ -584,7 +585,7 @@ efi_init (void) }printk ("mem%02d: %s " -"range=[0x%016lx-0x%016lx) (%4lu%s)\n" , +"range=[0x%016llx-0x%016llx) (%4lu%s)\n" , i,efi_md_typeattr_format (buf,sizeof (buf), md), md->phys_addr, md->phys_addr +efi_md_size (md), size, unit);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 588/601 kfifo: fix ternary sign extension bugs
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 926ee00ea24320052b46745ef4b00d91c05bd03d ]
The intent with this code was to return negative error codes but instead it returns positives.
The problem is how type promotion works with ternary operations. These functions return long, "ret" is an int and "copied" is a u32. The negative error code is first cast to u32 so it becomes a high positive and then cast to long where it's still a positive.
We could fix this by declaring "ret" as a ssize_t but let's just get rid of the ternaries instead.
--- samples/kfifo/bytestream-example.c | 8 ++++++-- samples/kfifo/inttype-example.c | 8 ++++++-- samples/kfifo/record-example.c | 8 ++++++-- 3 files changed, 18 insertions(+), 6 deletions(-)
samples/kfifo/bytestream-example.c +6 -2
@@ -122,8 +122,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, ret =kfifo_from_user (&test, buf, count, &copied);mutex_unlock (&write_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; } static ssize_t fifo_read(struct file *file, char __user *buf,
@@ -138,8 +140,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, ret =kfifo_to_user (&test, buf, count, &copied);mutex_unlock (&read_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; }static const struct proc_ops fifo_proc_ops = {
samples/kfifo/inttype-example.c +6 -2
@@ -115,8 +115,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, ret =kfifo_from_user (&test, buf, count, &copied);mutex_unlock (&write_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; } static ssize_t fifo_read(struct file *file, char __user *buf,
@@ -131,8 +133,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, ret =kfifo_to_user (&test, buf, count, &copied);mutex_unlock (&read_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; }static const struct proc_ops fifo_proc_ops = {
samples/kfifo/record-example.c +6 -2
@@ -129,8 +129,10 @@ static ssize_t fifo_write(struct file *file, const char __user *buf, ret =kfifo_from_user (&test, buf, count, &copied);mutex_unlock (&write_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; } static ssize_t fifo_read(struct file *file, char __user *buf,
@@ -145,8 +147,10 @@ static ssize_t fifo_read(struct file *file, char __user *buf, ret =kfifo_to_user (&test, buf, count, &copied);mutex_unlock (&read_lock); +if (ret) +return ret; -return ret ? ret : copied; +return copied; }static const struct proc_ops fifo_proc_ops = {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 589/601 mm/sl?b.c: remove ctor argument from kmem_cache_flags
In reply to Greg Kroah-HartmanFrom: Nikolay Borisov <[email protected]>
[ Upstream commit 3754000872188e3e4713d9d847fe3c615a47c220 ]
This argument hasn't been used since e153362a50a3 ("slub: Remove objsize check in kmem_cache_flags()") so simply remove it.
--- mm/slab.c | 3 +-- mm/slab.h | 6 ++---- mm/slab_common.c | 2 +- mm/slub.c | 9 +++------ 4 files changed, 7 insertions(+), 13 deletions(-)
mm/slab.c +1 -2
@@ -1790,8 +1790,7 @@ static int __ref setup_cpu_cache(struct kmem_cache *cachep, gfp_t gfp) }slab_flags_t kmem_cache_flags (unsigned int object_size, -slab_flags_t flags,const char *name, -void (*ctor)(void *)) +slab_flags_t flags,const char *name) {return flags; }
mm/slab.h +2 -4
@@ -110,8 +110,7 @@ __kmem_cache_alias(const char *name, unsigned int size, unsigned int align, slab_flags_t flags, void (*ctor)(void *));slab_flags_t kmem_cache_flags (unsigned int object_size, -slab_flags_t flags,const char *name, -void (*ctor)(void *)); +slab_flags_t flags,const char *name);#else static inline struct kmem_cache * __kmem_cache_alias(const char *name, unsigned int size, unsigned int align,
@@ -119,8 +118,7 @@ __kmem_cache_alias(const char *name, unsigned int size, unsigned int align, {return NULL ; }static inline slab_flags_t kmem_cache_flags (unsigned int object_size, -slab_flags_t flags,const char *name, -void (*ctor)(void *)) +slab_flags_t flags,const char *name) {return flags; }
mm/slab_common.c +1 -1
@@ -197,7 +197,7 @@ struct kmem_cache *find_mergeable(unsigned int size, unsigned int align, size =ALIGN (size,sizeof (void *)); align =calculate_alignment (flags, align, size); size =ALIGN (size, align); - flags =kmem_cache_flags (size, flags, name,NULL ); + flags =kmem_cache_flags (size, flags, name);if (flags &SLAB_NEVER_MERGE )return NULL ;
mm/slub.c +3 -6
@@ -1400,7 +1400,6 @@ __setup("slub_debug", setup_slub_debug);* @object_size: the size of an object without meta data * @flags: flags to set * @name: name of the cache -* @ctor: constructor function * * Debug option(s) are applied to @flags. In addition to the debug * option(s), if a slab name (or multiple) is specified i.e.
@@ -1408,8 +1407,7 @@ __setup("slub_debug", setup_slub_debug);* then only the select slabs will receive the debug option(s). */ slab_flags_t kmem_cache_flags (unsigned int object_size, -slab_flags_t flags,const char *name, -void (*ctor)(void *)) +slab_flags_t flags,const char *name) {char *iter;size_t len;
@@ -1474,8 +1472,7 @@ static inline void add_full(struct kmem_cache *s, struct kmem_cache_node *n,static inline void remove_full (struct kmem_cache *s,struct kmem_cache_node *n,struct page *page) {}slab_flags_t kmem_cache_flags (unsigned int object_size, -slab_flags_t flags,const char *name, -void (*ctor)(void *)) +slab_flags_t flags,const char *name) {return flags; }
@@ -3797,7 +3794,7 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)static int kmem_cache_open (struct kmem_cache *s,slab_flags_t flags) { - s->flags =kmem_cache_flags (s->size, flags, s->name, s->ctor); + s->flags =kmem_cache_flags (s->size, flags, s->name);#ifdef CONFIG_SLAB_FREELIST_HARDENED s->random =get_random_long ();#endif
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 590/601 mm, slub: enable slub_debug static key when creating cache with explicit debug flags
In reply to Greg Kroah-HartmanFrom: Vlastimil Babka <[email protected]>
[ Upstream commit 1f0723a4c0df36cbdffc6fac82cd3c5d57e06d66 ]
Commit ca0cab65ea2b ("mm, slub: introduce static key for slub_debug()") introduced a static key to optimize the case where no debugging is enabled for any cache. The static key is enabled when slub_debug boot parameter is passed, or CONFIG_SLUB_DEBUG_ON enabled.
However, some caches might be created with one or more debugging flags explicitly passed to kmem_cache_create(), and the commit missed this. Thus the debugging functionality would not be actually performed for these caches unless the static key gets enabled by boot param or config.
This patch fixes it by checking for debugging flags passed to kmem_cache_create() and enabling the static key accordingly.
Note such explicit debugging flags should not be used outside of debugging and testing as they will now enable the static key globally. btrfs_init_cachep() creates a cache with SLAB_RED_ZONE but that's a mistake that's being corrected [1]. rcu_torture_stats() creates a cache with SLAB_STORE_USER, but that is a testing module so it's OK and will start working as intended after this patch.
Also note that in case of backports to kernels before v5.12 that don't have 59450bbc12be ("mm, slab, slub: stop taking cpu hotplug lock"), static_branch_enable_cpuslocked() should be used.
[1] https://lore.kernel.org/linux-btrfs/[email protected]/
--- mm/slub.c | 9 +++++++++ 1 file changed, 9 insertions(+)
mm/slub.c +9 -0
@@ -3794,6 +3794,15 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)static int kmem_cache_open (struct kmem_cache *s,slab_flags_t flags) { +#ifdef CONFIG_SLUB_DEBUG +/* +* If no slub_debug was enabled globally, the static key is not yet +* enabled by setup_slub_debug(). Enable it if the cache is being +* created with any of the debugging flags passed explicitly. +*/ +if (flags &SLAB_DEBUG_FLAGS ) +static_branch_enable (&slub_debug_enabled); +#endif s->flags =kmem_cache_flags (s->size, flags, s->name);#ifdef CONFIG_SLAB_FREELIST_HARDENED s->random =get_random_long ();
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 591/601 mm: memcontrol: slab: fix obtain a reference to a freeing memcg
In reply to Greg Kroah-HartmanFrom: Muchun Song <[email protected]>
[ Upstream commit 9f38f03ae8d5f57371b71aa6b4275765b65454fd ]
Patch series "Use obj_cgroup APIs to charge kmem pages", v5.
Since Roman's series "The new cgroup slab memory controller" applied. All slab objects are charged with the new APIs of obj_cgroup. The new APIs introduce a struct obj_cgroup to charge slab objects. It prevents long-living objects from pinning the original memory cgroup in the memory. But there are still some corner objects (e.g. allocations larger than order-1 page on SLUB) which are not charged with the new APIs. Those objects (include the pages which are allocated from buddy allocator directly) are charged as kmem pages which still hold a reference to the memory cgroup.
E.g. We know that the kernel stack is charged as kmem pages because the size of the kernel stack can be greater than 2 pages (e.g. 16KB on x86_64 or arm64). If we create a thread (suppose the thread stack is charged to memory cgroup A) and then move it from memory cgroup A to memory cgroup B. Because the kernel stack of the thread hold a reference to the memory cgroup A. The thread can pin the memory cgroup A in the memory even if we remove the cgroup A. If we want to see this scenario by using the following script. We can see that the system has added 500 dying cgroups (This is not a real world issue, just a script to show that the large kmallocs are charged as kmem pages which can pin the memory cgroup in the memory).
#!/bin/bash
cat /proc/cgroups | grep memory
cd /sys/fs/cgroup/memory
echo 1 > memory.move_charge_at_immigrate
for i in range{1..500}
do
mkdir kmem_test
echo $$ > kmem_test/cgroup.procs
sleep 3600 &
echo $$ > cgroup.procs
echo cat kmem_test/cgroup.procs > cgroup.procs rmdir kmem_test
done
cat /proc/cgroups | grep memory
This patchset aims to make those kmem pages to drop the reference to memory cgroup by using the APIs of obj_cgroup. Finally, we can see that the number of the dying cgroups will not increase if we run the above test script.
This patch (of 7):
The rcu_read_lock/unlock only can guarantee that the memcg will not be freed, but it cannot guarantee the success of css_get (which is in the refill_stock when cached memcg changed) to memcg.
rcu_read_lock()
memcg = obj_cgroup_memcg(old)
__memcg_kmem_uncharge(memcg)
refill_stock(memcg)
if (stock->cached != memcg)
// css_get can change the ref counter from 0 back to 1.
css_get(&memcg->css) rcu_read_unlock()
This fix is very like the commit:
eefbfa7fd678 ("mm: memcg/slab: fix use after free in obj_cgroup_charge")
Fix this by holding a reference to the memcg which is passed to the __memcg_kmem_uncharge() before calling __memcg_kmem_uncharge().
--- mm/memcontrol.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
mm/memcontrol.c +9 -1
@@ -3190,9 +3190,17 @@ static void drain_obj_stock(struct memcg_stock_pcp *stock)unsigned int nr_bytes = stock->nr_bytes & (PAGE_SIZE -1 );if (nr_pages) { +struct mem_cgroup *memcg; +rcu_read_lock (); -__memcg_kmem_uncharge (obj_cgroup_memcg (old), nr_pages); +retry: + memcg =obj_cgroup_memcg (old); +if (unlikely (!css_tryget (&memcg->css))) + goto retry;rcu_read_unlock (); + +__memcg_kmem_uncharge (memcg, nr_pages); +css_put (&memcg->css); }/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 592/601 mm/sparse: add the missing sparse_buffer_fini() in error branch
In reply to Greg Kroah-HartmanFrom: Wang Wensheng <[email protected]>
[ Upstream commit 2284f47fe9fe2ed2ef619e5474e155cfeeebd569 ]
sparse_buffer_init() and sparse_buffer_fini() should appear in pair, or a WARN issue would be through the next time sparse_buffer_init() runs.
Add the missing sparse_buffer_fini() in error branch.
--- mm/sparse.c | 1 + 1 file changed, 1 insertion(+)
mm/sparse.c +1 -0
@@ -547,6 +547,7 @@ static void __init sparse_init_nid(int nid, unsigned long pnum_begin,pr_err ("%s: node[%d] memory map backing failed. Some memory will not be available." , __func__, nid); pnum_begin = pnum; +sparse_buffer_fini (); goto failed; }check_usemap_section_nr (nid, usage);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 593/601 mm/memory-failure: unnecessary amount of unmapping
In reply to Greg Kroah-HartmanFrom: Jane Chu <[email protected]>
[ Upstream commit 4d75136be8bf3ae01b0bc3e725b2cdc921e103bd ]
It appears that unmap_mapping_range() actually takes a 'size' as its third argument rather than a location, the current calling fashion causes unnecessary amount of unmapping to occur.
--- mm/memory-failure.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/memory-failure.c +1 -1
@@ -1364,7 +1364,7 @@ static int memory_failure_dev_pagemap(unsigned long pfn, int flags,* communicated in siginfo, see kill_proc() */ start = (page->index <<PAGE_SHIFT ) & ~(size -1 ); -unmap_mapping_range (page->mapping, start, start + size,0 ); +unmap_mapping_range (page->mapping, start, size,0 ); }kill_procs (&tokill, flags &MF_MUST_KILL , !unmap_success, pfn, flags); rc =0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 594/601 afs: Fix speculative status fetches
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
[ Upstream commit 22650f148126571be1098d34160eb4931fc77241 ]
The generic/464 xfstest causes kAFS to emit occasional warnings of the form:
kAFS: vnode modified {100055:8a} 30->31 YFS.StoreData64 (c=6015)This indicates that the data version received back from the server did not match the expected value (the DV should be incremented monotonically for each individual modification op committed to a vnode).
What is happening is that a lookup call is doing a bulk status fetch speculatively on a bunch of vnodes in a directory besides getting the status of the vnode it's actually interested in. This is racing with a StoreData operation (though it could also occur with, say, a MakeDir op).
On the client, a modification operation locks the vnode, but the bulk status fetch only locks the parent directory, so no ordering is imposed there (thereby avoiding an avenue to deadlock).
On the server, the StoreData op handler doesn't lock the vnode until it's received all the request data, and downgrades the lock after committing the data until it has finished sending change notifications to other clients - which allows the status fetch to occur before it has finished.
This means that:
- a status fetch can access the target vnode either side of the exclusive section of the modification
- the status fetch could start before the modification, yet finish after, and vice-versa.
- the status fetch and the modification RPCs can complete in either order.
- the status fetch can return either the before or the after DV from the modification.
- the status fetch might regress the locally cached DV.
Some of these are handled by the previous fix[1], but that's not sufficient because it checks the DV it received against the DV it cached at the start of the op, but the DV might've been updated in the meantime by a locally generated modification op.
Fix this by the following means:
(1) Keep track of when we're performing a modification operation on a vnode. This is done by marking vnode parameters with a 'modification' note that causes the AFS_VNODE_MODIFYING flag to be set on the vnode for the duration.
(2) Alter the speculation race detection to ignore speculative status fetches if either the vnode is marked as being modified or the data version number is not what we expected.
Note that whilst the "vnode modified" warning does get recovered from as it causes the client to refetch the status at the next opportunity, it will also invalidate the pagecache, so changes might get lost.
--- fs/afs/dir.c | 7 +++++++ fs/afs/dir_silly.c | 3 +++ fs/afs/fs_operation.c | 6 ++++++ fs/afs/inode.c | 6 ++++-- fs/afs/internal.h | 2 ++ fs/afs/write.c | 1 + 6 files changed, 23 insertions(+), 2 deletions(-)
fs/afs/dir.c +7 -0
@@ -1340,6 +1340,7 @@ static int afs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)afs_op_set_vnode (op,0 , dvnode); op->file[0 ].dv_delta =1 ; + op->file[0 ].modification = true; op->file[0 ].update_ctime = true; op->dentry = dentry; op->create.mode =S_IFDIR | mode;
@@ -1421,6 +1422,7 @@ static int afs_rmdir(struct inode *dir, struct dentry *dentry)afs_op_set_vnode (op,0 , dvnode); op->file[0 ].dv_delta =1 ; + op->file[0 ].modification = true; op->file[0 ].update_ctime = true; op->dentry = dentry;
@@ -1557,6 +1559,7 @@ static int afs_unlink(struct inode *dir, struct dentry *dentry)afs_op_set_vnode (op,0 , dvnode); op->file[0 ].dv_delta =1 ; + op->file[0 ].modification = true; op->file[0 ].update_ctime = true;/* Try to make sure we have a callback promise on the victim. */
@@ -1639,6 +1642,7 @@ static int afs_create(struct inode *dir, struct dentry *dentry, umode_t mode,afs_op_set_vnode (op,0 , dvnode); op->file[0 ].dv_delta =1 ; + op->file[0 ].modification = true; op->file[0 ].update_ctime = true; op->dentry = dentry;
@@ -1713,6 +1717,7 @@ static int afs_link(struct dentry *from, struct inode *dir,afs_op_set_vnode (op,0 , dvnode);afs_op_set_vnode (op,1 , vnode); op->file[0 ].dv_delta =1 ; + op->file[0 ].modification = true; op->file[0 ].update_ctime = true; op->file[1 ].update_ctime = true;
@@ -1908,6 +1913,8 @@ static int afs_rename(struct inode *old_dir, struct dentry *old_dentry,afs_op_set_vnode (op,1 , new_dvnode);/* May be same as orig_dvnode */ op->file[0 ].dv_delta =1 ; op->file[1 ].dv_delta =1 ; + op->file[0 ].modification = true; + op->file[1 ].modification = true; op->file[0 ].update_ctime = true; op->file[1 ].update_ctime = true;
fs/afs/dir_silly.c +3 -0
@@ -73,6 +73,8 @@ static int afs_do_silly_rename(struct afs_vnode *dvnode, struct afs_vnode *vnodeafs_op_set_vnode (op,1 , dvnode); op->file[0 ].dv_delta =1 ; op->file[1 ].dv_delta =1 ; + op->file[0 ].modification = true; + op->file[1 ].modification = true; op->file[0 ].update_ctime = true; op->file[1 ].update_ctime = true;
@@ -201,6 +203,7 @@ static int afs_do_silly_unlink(struct afs_vnode *dvnode, struct afs_vnode *vnodeafs_op_set_vnode (op,0 , dvnode);afs_op_set_vnode (op,1 , vnode); op->file[0 ].dv_delta =1 ; + op->file[0 ].modification = true; op->file[0 ].update_ctime = true; op->file[1 ].op_unlinked = true; op->file[1 ].update_ctime = true;
fs/afs/fs_operation.c +6 -0
@@ -118,6 +118,8 @@ static void afs_prepare_vnode(struct afs_operation *op, struct afs_vnode_param * vp->cb_break_before =afs_calc_vnode_cb_break (vnode);if (vnode->lock_state !=AFS_VNODE_LOCK_NONE ) op->flags |=AFS_OPERATION_CUR_ONLY ; +if (vp->modification) +set_bit (AFS_VNODE_MODIFYING , &vnode->flags); }if (vp->fid.vnode)
@@ -223,6 +225,10 @@ int afs_put_operation(struct afs_operation *op)if (op->ops && op->ops->put) op->ops->put (op); +if (op->file[0 ].modification) +clear_bit (AFS_VNODE_MODIFYING , &op->file[0 ].vnode->flags); +if (op->file[1 ].modification && op->file[1 ].vnode != op->file[0 ].vnode) +clear_bit (AFS_VNODE_MODIFYING , &op->file[1 ].vnode->flags);if (op->file[0 ].put_vnode)iput (&op->file[0 ].vnode->vfs_inode);if (op->file[1 ].put_vnode)
fs/afs/inode.c +4 -2
@@ -293,8 +293,9 @@ void afs_vnode_commit_status(struct afs_operation *op, struct afs_vnode_param *v op->flags &= ~AFS_OPERATION_DIR_CONFLICT ; } }else if (vp->scb.have_status) { -if (vp->dv_before + vp->dv_delta != vp->scb.status.data_version && - vp->speculative) +if (vp->speculative && + (test_bit (AFS_VNODE_MODIFYING , &vnode->flags) || + vp->dv_before != vnode->status.data_version))/* Ignore the result of a speculative bulk status fetch * if it splits around a modification op, thereby * appearing to regress the data version.
@@ -909,6 +910,7 @@ int afs_setattr(struct dentry *dentry, struct iattr *attr) } op->ctime = attr->ia_ctime; op->file[0 ].update_ctime =1 ; + op->file[0 ].modification = true; op->ops = &afs_setattr_operation; ret =afs_do_sync_operation (op);
fs/afs/internal.h +2 -0
@@ -640,6 +640,7 @@ struct afs_vnode {#define AFS_VNODE_PSEUDODIR 7/* set if Vnode is a pseudo directory */ #define AFS_VNODE_NEW_CONTENT 8/* Set if file has new content (create/trunc-0) */ #define AFS_VNODE_SILLY_DELETED 9/* Set if file has been silly-deleted */ +#define AFS_VNODE_MODIFYING 10/* Set if we're performing a modification op */ struct list_head wb_keys;/* List of keys available for writeback */ struct list_head pending_locks;/* locks waiting to be granted */
@@ -756,6 +757,7 @@ struct afs_vnode_param { bool set_size:1; /* Must update i_size */ bool op_unlinked:1; /* True if file was unlinked by op */ bool speculative:1; /* T if speculative status fetch (no vnode lock) */ + bool modification:1; /* Set if the content gets modified */ };/*
fs/afs/write.c +1 -0
@@ -450,6 +450,7 @@ static int afs_store_data(struct address_space *mapping,afs_op_set_vnode (op,0 , vnode); op->file[0 ].dv_delta =1 ; op->store.mapping = mapping; + op->file[0 ].modification = true; op->store.first = first; op->store.last = last; op->store.first_offset = offset;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 595/601 bpf: Fix alu32 const subreg bound tracking on bitwise operations
In reply to Greg Kroah-HartmanFrom: Daniel Borkmann <[email protected]>
commit 049c4e13714ecbca567b4d5f6d563f05d431c80e upstream.
Fix a bug in the verifier's scalar32_min_max_*() functions which leads to incorrect tracking of 32 bit bounds for the simulation of and/or/xor bitops. When both the src & dst subreg is a known constant, then the assumption is that scalar_min_max_*() will take care to update bounds correctly. However, this is not the case, for example, consider a register R2 which has a tnum of 0xffffffff00000000, meaning, lower 32 bits are known constant and in this case of value 0x00000001. R2 is then and'ed with a register R3 which is a 64 bit known constant, here, 0x100000002.
What can be seen in line '10:' is that 32 bit bounds reach an invalid state where {u,s}32_min_value > {u,s}32_max_value. The reason is scalar32_min_max_*() delegates 32 bit bounds updates to scalar_min_max_*(), however, that really only takes place when both the 64 bit src & dst register is a known constant. Given scalar32_min_max_*() is intended to be designed as closely as possible to scalar_min_max_*(), update the 32 bit bounds in this situation through __mark_reg32_known() which will set all {u,s}32_{min,max}_value to the correct constant, which is 0x00000000 after the fix (given 0x00000001 & 0x00000002 in 32 bit space). This is possible given var32_off already holds the final value as dst_reg->var_off is updated before calling scalar32_min_max_*().
Before fix, invalid tracking of R2:
[...]
9: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0,smin_value=-9223372036854775807 (0x8000000000000001),smax_value=9223372032559808513 (0x7fffffff00000001),umin_value=1,umax_value=0xffffffff00000001,var_off=(0x1; 0xffffffff00000000),s32_min_value=1,s32_max_value=1,u32_min_value=1,u32_max_value=1) R3_w=inv4294967298 R10=fp0 9: (5f) r2 &= r3
10: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0,smin_value=0,smax_value=4294967296 (0x100000000),umin_value=0,umax_value=0x100000000,var_off=(0x0; 0x100000000),s32_min_value=1,s32_max_value=0,u32_min_value=1,u32_max_value=0) R3_w=inv4294967298 R10=fp0
[...]
After fix, correct tracking of R2:
[...]
9: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0,smin_value=-9223372036854775807 (0x8000000000000001),smax_value=9223372032559808513 (0x7fffffff00000001),umin_value=1,umax_value=0xffffffff00000001,var_off=(0x1; 0xffffffff00000000),s32_min_value=1,s32_max_value=1,u32_min_value=1,u32_max_value=1) R3_w=inv4294967298 R10=fp0 9: (5f) r2 &= r3
10: R0_w=inv1337 R1=ctx(id=0,off=0,imm=0) R2_w=inv(id=0,smin_value=0,smax_value=4294967296 (0x100000000),umin_value=0,umax_value=0x100000000,var_off=(0x0; 0x100000000),s32_min_value=0,s32_max_value=0,u32_min_value=0,u32_max_value=0) R3_w=inv4294967298 R10=fp0
[...]
--- kernel/bpf/verifier.c | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-)
kernel/bpf/verifier.c +9 -13
@@ -6396,11 +6396,10 @@ static void scalar32_min_max_and(structs32 smin_val = src_reg->s32_min_value;u32 umax_val = src_reg->u32_max_value; -/* Assuming scalar64_min_max_and will be called so its safe -* to skip updating register for known 32-bit case. -*/ -if (src_known && dst_known) +if (src_known && dst_known) { +__mark_reg32_known (dst_reg, var32_off.value);return ; + }/* We get our minimum from the var_off, since that's inherently * bitwise. Our maximum is the minimum of the operands' maxima.
@@ -6420,7 +6419,6 @@ static void scalar32_min_max_and(struct dst_reg->s32_min_value = dst_reg->u32_min_value; dst_reg->s32_max_value = dst_reg->u32_max_value; } - } static void scalar_min_max_and(struct bpf_reg_state *dst_reg,
@@ -6467,11 +6465,10 @@ static void scalar32_min_max_or(struct bs32 smin_val = src_reg->s32_min_value;u32 umin_val = src_reg->u32_min_value; -/* Assuming scalar64_min_max_or will be called so it is safe -* to skip updating register for known case. -*/ -if (src_known && dst_known) +if (src_known && dst_known) { +__mark_reg32_known (dst_reg, var32_off.value);return ; + }/* We get our maximum from the var_off, and our minimum is the * maximum of the operands' minima
@@ -6536,11 +6533,10 @@ static void scalar32_min_max_xor(structstruct tnum var32_off =tnum_subreg (dst_reg->var_off);s32 smin_val = src_reg->s32_min_value; -/* Assuming scalar64_min_max_xor will be called so it is safe -* to skip updating register for known case. -*/ -if (src_known && dst_known) +if (src_known && dst_known) { +__mark_reg32_known (dst_reg, var32_off.value);return ; + }/* We get both minimum and maximum from the var32_off. */ dst_reg->u32_min_value = var32_off.value;
Greg Kroah-Hartman
maintainerPATCH 596/601 bpf, ringbuf: Deny reserve of buffers larger than ringbuf
In reply to Greg Kroah-HartmanFrom: Thadeu Lima de Souza Cascardo <[email protected]>
commit 4b81ccebaeee885ab1aa1438133f2991e3a2b6ea upstream.
A BPF program might try to reserve a buffer larger than the ringbuf size. If the consumer pointer is way ahead of the producer, that would be successfully reserved, allowing the BPF program to read or write out of the ringbuf allocated area.
--- kernel/bpf/ringbuf.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/bpf/ringbuf.c +3 -0
@@ -315,6 +315,9 @@ static void *__bpf_ringbuf_reserve(strucreturn NULL ; len =round_up (size +BPF_RINGBUF_HDR_SZ ,8 ); +if (len > rb->mask +1 ) +return NULL ; + cons_pos =smp_load_acquire (&rb->consumer_pos);if (in_nmi ()) {
Greg Kroah-Hartman
maintainerPATCH 597/601 bpf: Prevent writable memory-mapping of read-only ringbuf pages
In reply to Greg Kroah-HartmanFrom: Andrii Nakryiko <[email protected]>
commit 04ea3086c4d73da7009de1e84962a904139af219 upstream.
Only the very first page of BPF ringbuf that contains consumer position counter is supposed to be mapped as writeable by user-space. Producer position is read-only and can be modified only by the kernel code. BPF ringbuf data pages are read-only as well and are not meant to be modified by user-code to maintain integrity of per-record headers.
This patch allows to map only consumer position page as writeable and everything else is restricted to be read-only. remap_vmalloc_range() internally adds VM_DONTEXPAND, so all the established memory mappings can't be extended, which prevents any future violations through mremap()'ing.
--- kernel/bpf/ringbuf.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-)
kernel/bpf/ringbuf.c +8 -13
@@ -221,25 +221,20 @@ static int ringbuf_map_get_next_key(strureturn -ENOTSUPP ; } -static size_t bpf_ringbuf_mmap_page_cnt (const struct bpf_ringbuf *rb) -{ -size_t data_pages = (rb->mask +1 ) >>PAGE_SHIFT ; - -/* consumer page + producer page + 2 x data pages */ -return RINGBUF_POS_PAGES +2 * data_pages; -} -static int ringbuf_map_mmap (struct bpf_map *map,struct vm_area_struct *vma) {struct bpf_ringbuf_map *rb_map; -size_t mmap_sz; rb_map = container_of(map, struct bpf_ringbuf_map, map); - mmap_sz =bpf_ringbuf_mmap_page_cnt (rb_map->rb) <<PAGE_SHIFT ; - -if (vma->vm_pgoff *PAGE_SIZE + (vma->vm_end - vma->vm_start) > mmap_sz) -return -EINVAL ; +if (vma->vm_flags &VM_WRITE ) { +/* allow writable mapping for the consumer_pos only */ +if (vma->vm_pgoff !=0 || vma->vm_end - vma->vm_start !=PAGE_SIZE ) +return -EPERM ; + }else { + vma->vm_flags &= ~VM_MAYWRITE ; + } +/* remap_vmalloc_range() checks size and offset constraints */ return remap_vmalloc_range (vma, rb_map->rb, vma->vm_pgoff +RINGBUF_PGOFF ); }
Greg Kroah-Hartman
maintainerPATCH 598/601 net: Only allow init netns to set default tcp cong to a restricted algo
In reply to Greg Kroah-HartmanFrom: Jonathon Reinhart <[email protected]>
commit 8d432592f30fcc34ef5a10aac4887b4897884493 upstream.
tcp_set_default_congestion_control() is netns-safe in that it writes to &net->ipv4.tcp_congestion_control, but it also sets ca->flags |= TCP_CONG_NON_RESTRICTED which is not namespaced. This has the unintended side-effect of changing the global net.ipv4.tcp_allowed_congestion_control sysctl, despite the fact that it is read-only: 97684f0970f6 ("net: Make tcp_allowed_congestion_control readonly in non-init netns")
Resolve this netns "leak" by only allowing the init netns to set the default algorithm to one that is restricted. This restriction could be removed if tcp_allowed_congestion_control were namespace-ified in the future.
This bug was uncovered with
https://github.com/JonathonReinhart/linux-netns-sysctl-verify
--- net/ipv4/tcp_cong.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv4/tcp_cong.c +4 -0
@@ -230,6 +230,10 @@ int tcp_set_default_congestion_control(s ret = -ENOENT ; }else if (!bpf_try_module_get (ca, ca->owner)) { ret = -EBUSY ; + }else if (!net_eq (net, &init_net) && + !(ca->flags &TCP_CONG_NON_RESTRICTED )) { +/* Only init netns can set default to a restricted algorithm */ + ret = -EPERM ; }else { prev =xchg (&net->ipv4.tcp_congestion_control, ca);if (prev)
Greg Kroah-Hartman
maintainerPATCH 599/601 smp: Fix smp_call_function_single_async prototype
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
commit 1139aeb1c521eb4a050920ce6c64c36c4f2a3ab7 upstream.
As of commit 966a967116e6 ("smp: Avoid using two cache lines for struct call_single_data"), the smp code prefers 32-byte aligned call_single_data objects for performance reasons, but the block layer includes an instance of this structure in the main 'struct request' that is more senstive to size than to performance here, see 4ccafe032005 ("block: unalign call_single_data in struct request").
The result is a violation of the calling conventions that clang correctly points out:
block/blk-mq.c:630:39: warning: passing 8-byte aligned argument to 32-byte aligned parameter 2 of 'smp_call_function_single_async' may result in an unaligned pointer access [-Walign-mismatch]
smp_call_function_single_async(cpu, &rq->csd);
It does seem that the usage of the call_single_data without cache line alignment should still be allowed by the smp code, so just change the function prototype so it accepts both, but leave the default alignment unchanged for the other users. This seems better to me than adding a local hack to shut up an otherwise correct warning in the caller.
--- include/linux/smp.h | 2 +- kernel/smp.c | 20 ++++++++++---------- kernel/up.c | 2 +- 3 files changed, 12 insertions(+), 12 deletions(-)
include/linux/smp.h +1 -1
@@ -73,7 +73,7 @@ void on_each_cpu_cond(smp_cond_func_t covoid on_each_cpu_cond_mask (smp_cond_func_t cond_func,smp_call_func_t func,void *info,bool wait,const struct cpumask *mask); -int smp_call_function_single_async (int cpu,call_single_data_t *csd); +int smp_call_function_single_async (int cpu,struct __call_single_data *csd);#ifdef CONFIG_SMP
kernel/smp.c +10 -10
@@ -110,7 +110,7 @@ static DEFINE_PER_CPU(void *, cur_csd_instatic atomic_t csd_bug_count =ATOMIC_INIT (0 );/* Record current CSD work for current CPU, NULL to erase. */ -static void csd_lock_record (call_single_data_t *csd) +static void csd_lock_record (struct __call_single_data *csd) {if (!csd) {smp_mb ();/* NULL cur_csd after unlock. */
@@ -125,7 +125,7 @@ static void csd_lock_record(call_single_/* Or before unlock, as the case may be. */ } -static __always_inline int csd_lock_wait_getcpu(call_single_data_t *csd) +static __always_inline int csd_lock_wait_getcpu(struct __call_single_data *csd) {unsigned int csd_type;
@@ -140,7 +140,7 @@ static __always_inline int csd_lock_wait* the CSD_TYPE_SYNC/ASYNC types provide the destination CPU, * so waiting on other types gets much less information. */ -static __always_inline bool csd_lock_wait_toolong(call_single_data_t *csd, u64 ts0, u64 *ts1, int *bug_id) +static __always_inline bool csd_lock_wait_toolong(struct __call_single_data *csd, u64 ts0, u64 *ts1, int *bug_id) {int cpu =-1 ;int cpux;
@@ -204,7 +204,7 @@ static __always_inline bool csd_lock_wai* previous function call. For multi-cpu calls its even more interesting * as we'll have to ensure no other cpu is observing our csd. */ -static __always_inline void csd_lock_wait(call_single_data_t *csd) +static __always_inline void csd_lock_wait(struct __call_single_data *csd) {int bug_id =0 ;u64 ts0, ts1;
@@ -219,17 +219,17 @@ static __always_inline void csd_lock_wai }#else -static void csd_lock_record (call_single_data_t *csd) +static void csd_lock_record (struct __call_single_data *csd) { } -static __always_inline void csd_lock_wait(call_single_data_t *csd) +static __always_inline void csd_lock_wait(struct __call_single_data *csd) {smp_cond_load_acquire (&csd->node.u_flags, !(VAL &CSD_FLAG_LOCK )); }#endif -static __always_inline void csd_lock(call_single_data_t *csd) +static __always_inline void csd_lock(struct __call_single_data *csd) {csd_lock_wait (csd); csd->node.u_flags |=CSD_FLAG_LOCK ;
@@ -242,7 +242,7 @@ static __always_inline void csd_lock(calsmp_wmb (); } -static __always_inline void csd_unlock(call_single_data_t *csd) +static __always_inline void csd_unlock(struct __call_single_data *csd) {WARN_ON (!(csd->node.u_flags &CSD_FLAG_LOCK ));
@@ -276,7 +276,7 @@ void __smp_call_single_queue(int cpu, st* for execution on the given CPU. data must already have * ->func, ->info, and ->flags set. */ -static int generic_exec_single (int cpu,call_single_data_t *csd) +static int generic_exec_single (int cpu,struct __call_single_data *csd) {if (cpu ==smp_processor_id ()) {smp_call_func_t func = csd->func;
@@ -542,7 +542,7 @@ EXPORT_SYMBOL(smp_call_function_single);* NOTE: Be careful, there is unfortunately no current debugging facility to * validate the correctness of this serialization. */ -int smp_call_function_single_async (int cpu,call_single_data_t *csd) +int smp_call_function_single_async (int cpu,struct __call_single_data *csd) {int err =0 ;
kernel/up.c +1 -1
@@ -25,7 +25,7 @@ int smp_call_function_single(int cpu, vo }EXPORT_SYMBOL (smp_call_function_single); -int smp_call_function_single_async (int cpu,call_single_data_t *csd) +int smp_call_function_single_async (int cpu,struct __call_single_data *csd) {unsigned long flags;
Greg Kroah-Hartman
maintainerPATCH 600/601 Revert "net/sctp: fix race condition in sctp_destroy_sock"
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
commit 01bfe5e8e428b475982a98a46cca5755726f3f7f upstream.
This reverts commit b166a20b07382b8bc1dcee2a448715c9c2c81b5b.
This one has to be reverted as it introduced a dead lock, as syzbot reported:
CPU0 CPU1
---- ----
lock(&net->sctp.addr_wq_lock);
lock(slock-AF_INET6);
lock(&net->sctp.addr_wq_lock); lock(slock-AF_INET6);
CPU0 is the thread of sctp_addr_wq_timeout_handler(), and CPU1 is that of sctp_close().
The original issue this commit fixed will be fixed in the next patch.
--- net/sctp/socket.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
net/sctp/socket.c +8 -5
@@ -1520,9 +1520,11 @@ static void sctp_close(struct sock *sk,/* Supposedly, no process has access to the socket, but * the net layers still may. +* Also, sctp_destroy_sock() needs to be called with addr_wq_lock +* held and that should be grabbed before socket lock. */ -local_bh_disable (); -bh_lock_sock (sk); +spin_lock_bh (&net->sctp.addr_wq_lock); +bh_lock_sock_nested (sk);/* Hold the sock, since sk_common_release() will put sock_put() * and we have just a little more cleanup.
@@ -1531,7 +1533,7 @@ static void sctp_close(struct sock *sk,sk_common_release (sk);bh_unlock_sock (sk); -local_bh_enable (); +spin_unlock_bh (&net->sctp.addr_wq_lock);sock_put (sk);
@@ -4991,6 +4993,9 @@ static int sctp_init_sock(struct sock *ssk_sockets_allocated_inc (sk);sock_prot_inuse_add (net, sk->sk_prot,1 ); +/* Nothing can fail after this block, otherwise +* sctp_destroy_sock() will be called without addr_wq_lock held +*/ if (net->sctp.default_auto_asconf) {spin_lock (&sock_net (sk)->sctp.addr_wq_lock); list_add_tail(&sp->auto_asconf_list,
@@ -5025,9 +5030,7 @@ static void sctp_destroy_sock(struct socif (sp->do_auto_asconf) { sp->do_auto_asconf =0 ; -spin_lock_bh (&sock_net (sk)->sctp.addr_wq_lock);list_del (&sp->auto_asconf_list); -spin_unlock_bh (&sock_net (sk)->sctp.addr_wq_lock); }sctp_endpoint_free (sp->ep);local_bh_disable ();
Greg Kroah-Hartman
maintainerPATCH 601/601 sctp: delay auto_asconf init until binding the first addr
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
commit 34e5b01186858b36c4d7c87e1a025071e8e2401f upstream.
As Or Cohen described:
If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock held and sp->do_auto_asconf is true, then an element is removed from the auto_asconf_splist without any proper locking.
This can happen in the following functions:
1. In sctp_accept, if sctp_sock_migrate fails.
2. In inet_create or inet6_create, if there is a bpf program attached to BPF_CGROUP_INET_SOCK_CREATE which denies creation of the sctp socket.
This patch is to fix it by moving the auto_asconf init out of sctp_init_sock(), by which inet_create()/inet6_create() won't need to operate it in sctp_destroy_sock() when calling sk_common_release().
It also makes more sense to do auto_asconf init while binding the first addr, as auto_asconf actually requires an ANY addr bind, see it in sctp_addr_wq_timeout_handler().
This addresses CVE-2021-23133.
--- net/sctp/socket.c | 31 +++++++++++++++++-------------- 1 file changed, 17 insertions(+), 14 deletions(-)
net/sctp/socket.c +17 -14
@@ -357,6 +357,18 @@ static struct sctp_af *sctp_sockaddr_af(return af; } +static void sctp_auto_asconf_init (struct sctp_sock *sp) +{ +struct net *net =sock_net (&sp->inet.sk); + +if (net->sctp.default_auto_asconf) { +spin_lock (&net->sctp.addr_wq_lock); +list_add_tail (&sp->auto_asconf_list, &net->sctp.auto_asconf_splist); +spin_unlock (&net->sctp.addr_wq_lock); + sp->do_auto_asconf =1 ; + } +} +/* Bind a local address either to an endpoint or to an association. */ static int sctp_do_bind (struct sock *sk,union sctp_addr *addr,int len) {
@@ -418,8 +430,10 @@ static int sctp_do_bind(struct sock *sk,return -EADDRINUSE ;/* Refresh ephemeral port. */ -if (!bp->port) +if (!bp->port) { bp->port =inet_sk (sk)->inet_num; +sctp_auto_asconf_init (sp); + }/* Add the address to the bind address list. * Use GFP_ATOMIC since BHs will be disabled.
@@ -4993,19 +5007,6 @@ static int sctp_init_sock(struct sock *ssk_sockets_allocated_inc (sk);sock_prot_inuse_add (net, sk->sk_prot,1 ); -/* Nothing can fail after this block, otherwise -* sctp_destroy_sock() will be called without addr_wq_lock held -*/ -if (net->sctp.default_auto_asconf) { -spin_lock (&sock_net (sk)->sctp.addr_wq_lock); -list_add_tail (&sp->auto_asconf_list, - &net->sctp.auto_asconf_splist); - sp->do_auto_asconf =1 ; -spin_unlock (&sock_net (sk)->sctp.addr_wq_lock); - }else { - sp->do_auto_asconf =0 ; - } -local_bh_enable ();return 0 ;
@@ -9401,6 +9402,8 @@ static int sctp_sock_migrate(struct sockreturn err; } +sctp_auto_asconf_init (newsp); +/* Move any messages in the old socket's receive queue that are for the * peeled off association to the new socket's receive queue. */
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.11.21 release. There are 601 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.11.21-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.11.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.11:
12 builds: 12 pass, 0 fail
28 boots: 28 pass, 0 fail
70 tests: 70 pass, 0 failLinux version: 5.11.21-rc1-g1ec08480ab87
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04Jon
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.11.21 release. There are 601 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.11.21-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.11.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.11.21 release. There are 601 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.11.21-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.11.y
and the diffstat can be found below.thanks,
greg k-h
5.11.21-rc1 Successfully Compiled and booted on my Raspberry PI 4b (8g) (bcm2711)
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.11.21 release. There are 601 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.11.21-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.11.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
Apart from mips clang build failures no other new test failures noticed.
## Build
* kernel: 5.11.21-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.11.y
* git commit: 1ec08480ab8706a140351f1c2e58d1624a1e0942
* git describe: v5.11.19-944-g1ec08480ab87
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.11.y/build/v5.11.19-944-g1ec08480ab87
## Regressions (compared to v5.11.19-342-g601189766731)
* mips, build
- clang-10-allnoconfig
- clang-10-defconfig
- clang-10-tinyconfig
- clang-11-allnoconfig
- clang-11-defconfig
- clang-11-tinyconfig
- clang-12-allnoconfig
- clang-12-defconfig
- clang-12-tinyconfig
## No fixes (compared to v5.11.19-342-g601189766731)
## Test result summary
total: 72537, pass: 61040, fail: 1006, skip: 10228, xfail: 263,
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 193 total, 193 passed, 0 failed
* arm64: 27 total, 27 passed, 0 failed
* i386: 25 total, 25 passed, 0 failed
* mips: 45 total, 36 passed, 9 failed
* parisc: 9 total, 9 passed, 0 failed
* powerpc: 27 total, 27 passed, 0 failed
* riscv: 21 total, 21 passed, 0 failed
* s390: 18 total, 18 passed, 0 failed
* sh: 18 total, 18 passed, 0 failed
* sparc: 9 total, 9 passed, 0 failed
* x86_64: 27 total, 27 passed, 0 failed
## Test suites summary
* fwts
* igt-gpu-tools
* kselftest-android
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kvm
* kselftest-lib
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-zram
* kunit
* kvm-unit-tests
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* packetdrill
* perf
* rcutorture
* timesync-off
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.11.21 release. There are 601 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.11.21-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.11.y
and the diffstat can be found below.thanks,
greg k-h
Tested rc1 against the Fedora build system (aarch64, armv7, ppc64le, s390x, x86_64), and boot tested x86_64. No regressions noted.
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.11.21 release. There are 601 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 14 May 2021 14:47:09 +0000. Anything received after that time might be too late.
Build results:
total: 155 pass: 155 fail: 0 Qemu test results: total: 461 pass: 460 fail: 1
Failed tests:
mipsel:mips32r6-generic:malta_32r6_defconfig:nocd:smp:net,pcnet:ide:rootfs
Failure as already reported.
Guenter